Apache Fory vulnerabilities

11 CVEs affecting Apache Fory, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71560, published 2026-08-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-61622, published 2025-10-01. Critical severity, CVSS 9.8. EPSS: 43.5% chance of exploitation in the next 30 days. Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is…
CVE-2026-71558, published 2026-08-07. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility…
CVE-2026-48207, published 2026-05-21. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name…
CVE-2026-64608, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field…
CVE-2026-71559, published 2026-08-07. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata,…
CVE-2026-64606, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects…
CVE-2026-64609, published 2026-07-21. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band…
CVE-2026-71560, published 2026-08-07. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields.…
CVE-2026-50076, published 2026-06-04. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration,…
CVE-2026-60080, published 2026-07-21. High severity, CVSS 7.3. EPSS: 0.7% chance of exploitation in the next 30 days. Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior,…